Merge pull request #264 from github/remove_contents

remove contents of script and style elements

lib/gollum/sanitization.rb

@@ -55,6 +55,13 @@ module Gollum
       end
     end
 
+    # Default elements whose contents will be removed in addition
+    # to the elements themselve
+    REMOVE_CONTENTS = [
+      'script',
+      'style'
+      ].freeze
+
     # Default transformers to force @id attributes with 'wiki-' prefix
     TRANSFORMERS = [
       lambda do |env|
@@ -104,6 +111,10 @@ module Gollum
     # Default: {}
     attr_reader :add_attributes
 
+    # Gets an Array of element names whose contents will be removed in addition
+    # to the elements themselves. Default: REMOVE_CONTENTS
+    attr_reader :remove_contents
+
     # Sets a boolean determining whether Sanitize allows HTML comments in the
     # output.  Default: false.
     attr_writer :allow_comments
@@ -114,6 +125,7 @@ module Gollum
       @protocols        = PROTOCOLS
       @transformers     = TRANSFORMERS
       @add_attributes   = {}
+      @remove_contents  = REMOVE_CONTENTS
       @allow_comments   = false
       @id_prefix        = 'wiki-'
       yield self if block_given?
@@ -144,6 +156,7 @@ module Gollum
         :attributes       => attributes,
         :protocols        => protocols,
         :add_attributes   => add_attributes,
+        :remove_contents  => remove_contents,
         :allow_comments   => allow_comments?,
         :transformers     => transformers,
         :id_prefix        => id_prefix

test/test_markup.rb

@@ -459,6 +459,18 @@ np.array([[2,2],[1,3]],np.float)
     compare(content, output)
   end
 
+  test "removes style blocks completely" do
+    content = "<style>body { color: red }</style>foobar"
+    output = "<p>foobar</p>"
+    compare(content, output)
+  end
+
+  test "removes script blocks completely" do
+    content = "<script>alert('hax');</script>foobar"
+    output = "<p>foobar</p>"
+    compare(content, output)
+  end
+
   test "escaped wiki link" do
     content = "a '[[Foo]], b"
     output = "<p>a [[Foo]], b</p>"